MISP 2.4.128 fixes CVE-2020-14969 ACL flaw
MISP 2.4.128 patches an attribute correlation ACL bypass and adds major STIX import/export refactoring.
MISP released version 2.4.128, addressing CVE-2020-14969, a vulnerability in which app/Model/Attribute.php lacked an ACL lookup on attribute correlations. This flaw allowed the attribute restsearch API to expose metadata about a correlating but otherwise unreachable attribute, potentially leaking information to users who should not have visibility into it.
Beyond the security fix, this release includes a significant refactoring of STIX 1 and 2 import/export functionality, contributed by Christian Studer. The most notable improvement automatically maps imported threat-actor, tool, and similar data-points to existing MISP galaxy entries, linking synonyms found in STIX files to known galaxy clusters and tags. Additional changes include CIDR correlation support for ip-src|port and ip-dst|port types and a new authentication failure dashboard widget sourced from the D4 project, along with broader updates to misp-objects, misp-taxonomies, and misp-galaxy.
This is a routine software update and vulnerability disclosure for a widely used threat-intelligence sharing platform rather than an active exploitation event. Organizations running MISP should upgrade to 2.4.128 to remediate the ACL bypass and benefit from the STIX processing improvements.
Mentioned in this report
Source reporting: https://www.misp-project.org/2020/06/24/misp.2.4.128.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free